Doxing: Dangers and Defenses
Total Page：16
File Type：pdf, Size：1020Kb
Doxing: Dangers and Defenses By Julia Moyer Mentor: Ming Chow Fall 2016 2 Table of Contents: Abstract………….……………………………………………………………3 Introduction…………………………………………………………………..4 To the Community…………………………………………………………...5 Methodologies………………………………………………………………..6 Information Gathering and Tools………………………………………6 Public Platforms………………………………………………………..7 Known Cases…………………………………………………………………7 The KKK……………………………………………………………….7 Zoe Quinn………………………………………………………………8 Scarlett Johansson and other celebrities………………………………..8 Defenses………………………………………………………………………9 Prevention………………………………………………………………9 Coping…………………………………………………………………10 Conclusions………………………………………………………………….12 References…………………………………………………………………...13 3 Abstract: With the explosion of the Internet and social media came both great communication advantages, and vast privacy issues. Among the scariest for the everyday Internet user is doxing – the practice of making people’s personal information publicly available where it used to be private or hard to access. This information can sometimes be gleaned from hacks and IP lookups, but is more often than not retrieved using everyday online tools such as search engines, social media profiles, and reverse phone lookups. Once an attacker has gained an individual’s information, there is no limit to their malice. Techniques include cyber bullying and intimidation, public humiliation, fake sign ups for services, ransom requests, and most menacingly, stalking and child abduction. Though many of these attacks were possible before the age of the Internet, the web facilitates access to information that could have taken much more time and risk to gather in earlier days. Increased security settings are a must to help protect information posted to social media. Even more important than technological security advances is widely distributed literature about the advantages of using such security settings, as everyday web users are often painfully unaware of the consequences of open profiles. To take an even more extreme view, large social media outlets should take on the responsibility of defaulting all user profiles to maximum security. 4 Introduction: Techopedia defines doxing (alternatively, doxxing), as “the process of retrieving, hacking and publishing other people’s information such as names, addresses, phone numbers and credit card details”.1 While this definition covers many applications of doxing, to really understand the practice, one must additionally have an understanding of its common motivations and implications. It may be targeted at a particular individual, an organization, or a specific demographic (see “Known Cases” for more details on female gamer-specific attacks)1, and may be prompted by curiosity, social activism, or (most typically) malicious intent, acquisition of power, and coercion1. Often, an attacker gains nothing material from the hack. Rather, the intent of the attack is to shame, humiliate, blackmail or take revenge on a victim.3 An attacker is often motivated to dox someone whose online presence (including blogs, articles and social media comments, and posts) insults or offends them in some fashion.4 Doxing, whose name originated from the file extension “.doc”1, is characterized by file tracing and sharing.3 Most often, the information that attackers collect is publicly available on social media and phone lookup sites. However, the victim rarely expects or intends for these pieces of information, spread out at various locations around the internet, to be pieced together to form a full picture of their life, location, and identity. For example, in 2014, Garrett Bryant posted an innocuous relationship status change to his Facebook profile. Several friends commented on the post congratulating him, unintentionally revealing that Garrett’s new partner was another male. Garret quickly deleted the post, afraid his Boy Scout leaders would find out about his sexuality, but the damage had been done. Due to tracing on social media, Garrett’s sexuality was exposed and his chances at working at a Boy Scout camp were demolished.3 This example goes to show that very minimal resources are needed for an impactful dox. The rest of this paper will explore other known cases of doxing, the methodologies successful doxers have used, and potential mitigation strategies the public should be aware of. 5 To the Community: Though the formal name may be unfamiliar, doxing is an attack that almost everyone living in the twenty first century has heard stories of, read articles about, or even been victim to, regardless of their relationship to the tech world. Before I even had an inkling of interest in technology, I’d heard horror stories about cyber bullying and abduction via doxing practices. Doxing is not an attack that only governments, elite technology companies, and advanced hackers are affected by. Doxers are generally not targeting high-security information, but rather looking to cause personal and emotional damage. Doxing affects our neighbors, our friends, our children, and us. Think about it: how many people do you know that update any sort of social media profile? How many times have you sent a password or email address over a public network? How many emails have you sent to unknown recipients, or comments have you posted on a insecure blogging website? Any one of these actions has the potential to expose your emails, passwords, photos, IP address and other identifying information to doxers in a dangerous way. In the world where there is virtually no option to remain private, we must all be informed of the dangers that come with the powerful virtual tools we use everyday. The aim of this paper is to disperse basic knowledge of the types of attacks my readers are liable to fall victim to, and how to protect themselves from real, on- and offline danger and harassment. 6 Methodologies: Doxing methodologies can range from very basic Internet searches, to more advanced hacks into private emails and social media outlets. This section will explore the tools and methodologies required for several different levels of attacks, as well the most common platforms for dispersing the acquired information. Information Gathering and Tools Most doxes begin with minimal and easily available information such as a username or a social media profile and require tools as simple and cheap as an anonymous email address, a search engine, and some social engineering skills.5 From here, the attacker must gather as much basic information on his victim as possible. This generally includes information like email, home address, IP address, personal operating system, phone number, website, and photo.5 Once in possession of this information, he can then progress to gathering more sensitive information, although sometimes the basic information is plenty to meet the attacker’s needs. There are several common methods and tools for acquiring the essential information about a victim. Since everyone’s online presence is different, there is no fixed place for an attacker to start looking. A common start is examining at the victim’s social media profiles, which can be found on search engines such as Pipl,6 Spokeo7 and Knowem8 by linking a given name or username to connected accounts. A large amount of additional information can be gotten from social media pages, including location, family members, friends, and information about workplace. Using name and location, an attacker can utilize a site like whitepages.com9 or 411.com10 to search for the exact address of the victim.11 If, instead of social media, an attack has access to the victim’s email address, there are a number of straightforward ways he may attain the victim’s IP address. On whatstherip.com12, he may enter his own email, and select a link to send to the victim. When the link is clicked, the IP address will be sent directly to the attacker’s email. IPs can also be obtained from any email that the victim has sent to the attacker, in the source file.5 Using the IP on ipaddress.com13, the attack may gain access to the victim’s exact location, as well as operating system and 7 ISP. Finally, an attacker can upload his victim’s photos to tineye.com14 to see where else they are posted, or search their personal webpage on who.is15 for additional personal details. Public Platforms In many cases, obtaining the victim’s personal information is not enough. Although some attackers will use their newly acquired network of facts to silently stalk, or to steal from their victims, doxing is characterized by the posting of the victim’s information on a public platform, such that the victim feels threatened, and the attacker’s network also has access to the information. One commonly used site is PasteBin16, which, though mostly used for sharing stories and ideas publicly, is notorious for its part in distributing stolen and illegitimate information.17 Similar sites like 4chan and Reddit have also seen their fair shares of doxed information. Known Cases: As previously discussed, methods and motivations for doxing can vary widely across cases. In this section I present several well-documented cases to demonstrate several of the various forms that doxing can take. The KKK: Anonymous is an international hacking group, known for its activism in the political, social, religious and institutional realms. It is an open group, comprised of hackers all over the world, each working for the cause in which they most strongly believe. According to one ex-member, the only unifying goal is to fight oppression.18 On November 5th, 2015, Anonymous leaked hundreds of names of alleged KKK members onto Pastebin (see Methodologies).19 The Anonymous hackers were able to retrieve the names by accessing a Klan-controlled Twitter account. From there, they could view all information the account was privy too.20 This dox was likely carried out via fairly simple tools such as network sniffers and password crackers. In this case, doxing was arguably used for good – namely, to encourage reform or remorse in the exposed members of hate group – but doxing, even when well intentioned, can still be ethically ambiguous. In 2014, a member of Anonymous doxed 8 a Ferguson police officer who he believed to be responsible for Michael Brown’s death.